Privacy & compliance

CIAM sits on the most regulated data a company holds — who its customers are — so privacy handling isn’t a side feature, it’s a reason the category is bought in the first place.

The law lands directly on the identity layer: a lawful basis and explicit consent captured at collection, proof of what was agreed and when (the consent receipt), withdrawal as easy as granting, and data-subject rights including the deletion that has to propagate beyond the identity store. Weak platforms store a single boolean and call it consent — which fails the proof requirement.

Regulated industries raise the bar again: fintech adds strong customer authentication (PSD2 SCA), step-up on money movement, audit retention, and often data residency. These guides cover what compliance teams should require — and confirm — before the technical evaluation, not after.